High 7.1Published Jul 25, 2026

CVE-2026-64323udf: validate VAT header length against the VAT inode size

Updated under an hour ago (Oct 26, 2026, 6:23 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udf_load_vat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size: map->s_type_specific.s_virtual.s_start_offset = le16_to_cpu(vat20->lengthHeader); map->s_type_specific.s_virtual.s_num_entries = (sbi->s_vat_inode->i_size - map->s_type_specific.s_virtual.s_start_offset) >> 2; lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds the VAT inode size, the s_num_entries subtraction underflows to a huge count, which defeats the "block > s_num_entries" bound in udf_get_pblock_virt15(); and on the ICB-inline path that function reads ((__le32 *)(iinfo->i_data + s_start_offset))[block] so a large s_start_offset indexes past the inode's in-ICB data. Mounting a crafted UDF image with a virtual (VAT) partition then triggers an out-of-bounds read. Reject a VAT whose header length does not leave room for at least one entry within the VAT inode.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from fa5e08156335d0687c85b4e724db9448fb166601 before 0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934; from fa5e08156335d0687c85b4e724db9448fb166601 before 883962731420ec271ed8c1cd76524f4b17faa982; from fa5e08156335d0687c85b4e724db9448fb166601 before 2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63; from fa5e08156335d0687c85b4e724db9448fb166601 before bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb; from fa5e08156335d0687c85b4e724db9448fb166601 before 55287a3555ff0515b3aff181d2c08c0462a41709; from fa5e08156335d0687c85b4e724db9448fb166601 before e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad; from fa5e08156335d0687c85b4e724db9448fb166601 before 74580fdf022909e184223cacc364feb826982d96; from fa5e08156335d0687c85b4e724db9448fb166601 before d8202786b3d75125c84ebc4de6d946f92fde0ee8	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.26 before 5.10.261; from 5.11 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4	NVD

References

References

https://git.kernel.org/stable/c/0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934	patch
https://git.kernel.org/stable/c/883962731420ec271ed8c1cd76524f4b17faa982	patch
https://git.kernel.org/stable/c/2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63	patch
https://git.kernel.org/stable/c/bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb	patch
https://git.kernel.org/stable/c/55287a3555ff0515b3aff181d2c08c0462a41709	patch
https://git.kernel.org/stable/c/e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad	patch
https://git.kernel.org/stable/c/74580fdf022909e184223cacc364feb826982d96	patch
https://git.kernel.org/stable/c/d8202786b3d75125c84ebc4de6d946f92fde0ee8	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.